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1. Introduction 


The Oil and Gas industry has hazards and Risks that are inherent to its assets, activities, operational 
locations, and products. The Companies belong to The EGPC and the Holding Companies, (including 
the Egyptian Natural Gas Holding Company (EGAS), the Egyptian Petrochemical Holding Company 
(ECHEM) and the South Valley Petroleum Holding Company (GANOPE)), are committed to pursuing 
no harm to people and the community and managing Risks through effective controls. Companies 
shall manage all Risks to As Low as Reasonably Practicable (ALARP). 

The Oil and Gas industry’ Risks accompanied with process failures and chemical releases contain 
severe consequences which should be managed quantitatively. The Quantitative Risk Assessment 
(QRA) is a component of an organization’s total Risk management: it is a part of the Companies’ 
Risk Management Program. QRA is used to help evaluate potential Risks when qualitative methods 
cannot provide adequate understanding of the Risks and more information is needed for Risk 
management. 

The QRA is a formal and structured quantitative analysis methodology used to help Companies 
manage Risk and improve safety through identifying the Major Hazards (i.e. identify incident 
scenarios), evaluating the associated likelihood and consequences to people, and calculating Risk 
levels in a numerical way for comparison with Risk Tolerability Criteria, and defining 
recommendations for guaranteeing proper Risk management is in place. QRA helps to make 
facilities handling hazardous chemicals safer by supporting Risk Based Decision Making. 


2. Purpose 


This Guideline describes the main components of the QRA studies and its main outputs, as well as 

establishes consistent requirements for planning, conducting, documenting, reviewing and 

approving the QRA studies for the Companies belong to The EGPC and the Holding Companies. 

All QRA studies carried out for the Companies belong to The EGPC and the Holding Companies shall 

be in accordance with the requirements of this Guideline. 

This QRA guideline focuses on protecting people inside and around the Major Hazard facilities, 

while protection of Assets will be covered in the Fire and Explosion Risk Assessment (FERA) 

Guideline, (EGPC-PSM-GL-009). (Note: The FERA scope and deliverables could be covered as a part of the 

QRA-especially if the study scope is not big or complicated). 

This Guideline aims to provide a framework for: 

@ When and How to use the QRA, 

e What is expected from the QRA, 

The QRA Methodology, 

The Scope of the QRA study, 

The minimum contents of the assumption register, 

Understanding the QRA results, beyond the obvious statistical meanings, 

The consequences modelling and the complete QRA results, 

How to compare the QRA Risk results to the EGPC & Holding Companies’ Quantitative Tolerable 

Risk Criteria, 

e Supporting the demonstration that Risk levels are reduced As Low As Reasonably Practicable 
(ALARP Demonstration), 

@ The QRA report main components. 
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3. Scope 

This document stipulates the mandatory requirements applicable to the Egyptian General 
Petroleum Corporation (EGPC) and Oil and Gas Holding Companies, including the Egyptian Natural 
Gas Holding Company (EGAS), the Egyptian Petrochemical Holding Company (ECHEM) and the South 
Valley Petroleum Holding Company (GANOPE) covering all of their operational subsidiaries, state- 
owned companies, affiliates and joint ventures. 

ENTITIES and their COMPANIES and contractors shall ensure that all requirements listed herein are 
fully understood, implemented, complied with and monitored at all times including current 
operations, existing and future projects during the whole projects’ lifecycle from feasibility till 
decommissioning. 


4. Definitions & Abbreviations 
ENTITIES: hereinafter are used to indicate EGPC and Holding Companies i.e., EGAS, ECHEM and 
GANOPE that are required to enforce implementation of this standard across their COMPANIES. 
COMPANIES: hereinafter are used to indicate operating company, subsidiary, affiliated, Joint 
Venture companies that are required to comply with ENTITIES’ standards. 
For Definitions and Abbreviations refer to PSM Glossary document EGPC-PSM-GL-011. 


5. Linked Internal Standards and Guidelines 


« Risk Management Standard EGPC-PSM-ST-001, 

e Process Safety Studies in Major Projects Guideline EGPC-PSM-GL-002, 

e Major Accident Hazard Management Guideline EGPC-PSM-GL-006, 

e Fire and Explosion Risk Assessment (FERA) Guideline EGPC-PSM-GL-009, 

e Process Safety Key Performance Indicators (KPIs) Guideline EGPC-PSM-GL-025, 
e ALARP Demonstration Guideline EGPC-PSM-GL-010, 

e PSM Glossary of Definition and Abbreviation Guideline EGPC-PSM-GL-011, 
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6. General Requirements 


e The QRA study shall be executed for the Major Hazard site(s)/ facility(ies) (handle, process, store, 
transport, distribute, hazardous material) exposed to total/partial /permanent/temporary 
occupancy of workers, as well as, for the presence of people (public) nearby the 
site(s)/facility(ies), 

The QRA shall be conducted by competent personnel, 

The QRA shall not be conducted in isolation, 

The QRA shall use appropriate data, 

The QRA shall use the correct level of details, 

The QRA shall use appropriate software / models, 

The QRA objectives shall be to reduce Risk rather than prove acceptability, 

The QRA shall reduce Risk to ALARP rather than a fixed level, 

The QRA shall represent the reality. 


7. QRA Lifecycle through Project Different Phases 


The QRA can be applied in the initial siting and design of the facility (Greenfield) and during its 
entire life (brownfield), while the maximum benefits result when QRA is applied at the beginning 
(conceptual and design stages) of a project and maintained throughout its life. The QRA helps in 
comparing options during the design phase or for modifications during operations. 


7.1. Greenfield 


When a new facility starts from scratch, and where the QRA is mandatory, the QRA shall be 
executed through the following different project phases, (the objective of the study may be also 
varied for each project phase): 


7.1.1. Evaluation / Concept Selection Phase 


QRA process starts at concept stage. In some cases, Preliminary QRA may be carried out during 
concept stage especially where several options have been identified. This allows a comparison of 
the relative Risk levels from the different options to support the decision making process. 

(Note: Refer to Process Safety Studies in Major Projects Guideline EGPC-PSM-GL-002; The Preliminary Risk 
Studies are a simplified form of the QRA, based upon a combination of generic technology/process data and 
site-specific data. Due to the basic nature of the available information on the technologies and processes at 
this stage of the project, the analysis uses industry data, such as the likelihood of fires/explosions for similar 
facilities. The consequence part of the analysis may use either estimate for inventories and process conditions 
or generic industry data from similar facilities. Available site-specific data includes meteorological data, and 
locations of hazardous inventories, local communities, workforce, and other areas of interest. These 
Preliminary Risk Studies are unlikely to be as accurate in absolute terms as the QRA studies conducted at later 
stages of the project when the detailed design has evolved. However, the application of Preliminary Risk 
Studies to multiple options in a comparison approach largely overcomes the problem of inaccuracies in the 
assumptions used in the absence of definitive data. The difference in Risk between options is the important 
factor, not the absolute level of Risk. This allows the Project Management Team to compare the safety Risks 
between options and rank them accordingly. It can also provide insights into potential business interruption 
and property damage related Risks between options) 


7.1.2. Basic Engineering / Front End Engineering Design (FEED) 


A Comprehensive QRA shall be performed during the FEED Stage of the project in order to provide a 
numerical estimate of onsite and/or offsite Risk exposures to people or other areas of interest. This 
allows Risk levels to be compared with corporate Risk Tolerance Criteria and provides input where 
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EGPC ss Saas 
Risk reduction measures are required to demonstrate ALARP on decisions regarding strategies to 
mitigate Risk, which need to be resolved prior to the detailed design stage of the project. 


7.1.3. Detailed Engineering 

The QRA study conducted during the FEED shall be updated, as required, during the Detailed 

Engineering Phase based on newly established information/data especially vendor-designed 

equipment data. QRA also forms the basis for the Operation Phase. 

7.2. Brownfield 

(Existing facilities/ under development/ new expansion projects/ revamp projects) the following 

should be considered: 

7.2.1. For existing facilities, where QRA is not available, 
The QRA shall be carried out at the first available opportunity (earliest). 
7.2.2. For existing facilities, and new expansion to be established 

e Anintegrated QRA for the existing and the planned facilities shall be carried out. (Ref. 7.1.). 
7.2.3. For existing facilities, where QRA is available, 

The QRA shall be reviewed, and revalidated or updated, if required, based on: 

«If significant changes to facilities (e.g., modification in process, feed changes, new technology), 
barriers, manning level, building functionality or building occupancy, etc. are observed or carried 
out. 

e During developing and updating the Company Safety Case study, 

e Every 5 years the QRA to ensure integrated Risk from all existing facilities including modification 
and brownfield projects is considered. 

(Note; Where there are no significant changes identified over five years and the outcomes of previous QRA 

report are still applicable and technically robust, and there is no required update for the QRA. In such case, 

Companies shall develop technical justifying note for revalidation of the study with relevant supporting 


documents (such as QRA Consultant revalidation report, and if any HAZID, Risk Register review, MOC, etc. are 
executed for the existing facility), and submit to the EGPC and the Holding companies for approval). 


8. QRA Methodology 

The basis of QRA methodology is to identify incident scenarios and evaluate the Risk by defining the 

frequency of failure, the probability of various consequences and the potential impact of those 

consequences, The Risk is defined in QRA as a function of probability or frequency and consequence 

of a particular accident scenario [1]: 

Risk = F(s, c, f) 

S= Hypothetical Scenario C= Estimated Consequence(S) f= Estimated Frequency 

This “function” can be extremely complex and there can be many numerically different Risk 

measures (using different Risk functions) calculated from a given set of s, c, f. 

The objective of QRA Methodology is to cover the following activities: 

e Set the QRA scope and define the assumption register contents. 

e Define the potential event sequences and potential incidents. This may be based on qualitative 
hazard analysis for screening level analysis. Complete or complex analysis is normally based on a 
full range of possible incidents for all sources. 

© Evaluate the incident outcomes (consequences). Some typical tools include vapor cloud 
dispersion modelling and fire and explosion effect modelling. 

e Estimate the incident impacts on people. 
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(The QRA methodology flowchart illustrated in Figure 1) 


Estimate the potential incident frequencies. Fault Trees or generic databases may be used for 
the initial event sequences. Event Trees may be used to account for mitigation and post release 
events. 

Estimate the Risk. This is done by combining the potential consequence for each event with the 
event frequency, and summing over all events. 

Evaluate the Risk. Identify the major sources of Risk and determine if there are cost-effective 
process or plant modifications which can be implemented to reduce Risk. Often this can be done 
without extensive analysis. Small and inexpensive system changes sometimes have a major 
impact on Risk. 

Do the Risk Evaluation against legally required Risk Tolerability Criteria if available, or internal 
corporate guidelines (as applied in our case), or comparison with other processes or more 
subjective Criteria. 

Identify and prioritize potential Risk Reduction Measures if the Risk is considered to be excessive. 


8,1. QRA Scope of Work 
8.2. QRA Assumption Register 


8.3. Hazard Identification and Failure Cases 
Development (Accident Scenarios) 
(PHA, HAZOP, Methodical Leak/ Rupture) 


8,5. Frequency 8.4. Consequence 
Assessment Assessment 


Parts Count for Physical Effect 
Isolatable Sections (Flammable, Explosive, and Toxic) 


Impact 
Assessment 


Hazardous E} 
jazardous Events (Vulnerability ) 


Likelihood 


ine. EGPC-PSMGL-009)) 


8.6. Other 
data for risk 


calculation 8.7. Risk Analysis 


8.9. ALARP 
Demonstration / 
Sensitivity Analysis 


Figure 1: The QRA Methodology Flowchart 
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8.1. QRA Scope of Work 
The Company is responsible for identifying the scope of work of the QRA study, and submitting it to 
the QRA Consultant to prepare the assumption register in order to start the execution of the study, 
or In case of the Company has the capabilities to execute the QRA study internally (by its competent 
staff and using accredited software), the scope of the study shall be submitted to or prepared in 
co-operation with the QRA internal concerned department (the loss prevention/ process safety/ 
QRA team). (Note: The scope of work could be identified through a meeting with the QRA Consultant(s). 
The scope of a QRA includes necessary details to define the QRA as a single document and includes: 
8.1.1. The Objective of The QRA Study, 


The QRA may have one or more objectives depending on the driving factor(s) to execute the study; 
these driving factors (triggers) may be one or more of the followings: 


e Alegal requirement, 
e An engineering requirement (loss prevention point of view), 
Support the Safety Case development, 
Support a decision-making process, 
Demonstrate that the Risk to workers and public is acceptable and controlled. 
e Required by shareholders, 
© Part of a bidding process for new project. 
Examples for specific objectives for the QRA are: 


e Identify hazards in a certain process, 
e Assess the significance of each incident in terms of on-site & off-site impact, 
¢ Predict the frequency of occurrence, 
e Determine the extent of harmful consequences, 
e Identify and provide Risk Reduction Measures to ensure the Risk is “As Low As Reasonably 
Practicable” (ALARP), 
e Demonstrate that the preferred Risk Reduction Measure reduces Risk to ALARP. 
8.1.2. The Facility Description, 
The scope of the work shall contain a brief description for the facility to elaborate the main 
processes, main equipment, handled materials types and inventories, operating and design 
parameters, and the facility location. 
8.1.3. Types of Risks to be Evaluated, 
The choice of the types of Risk to be addressed by the QRA will depend on the objectives identified, 
the QRA evaluated Risk mainly focus on the loss of life for workers and public in terms of individual 
and Societal Risk. (Note: The QRA focuses mainly on the loss of life, and for assets loss / vulnerability refer to 
(FERA) Guideline, EGPC-PSM-GL-009). 
8.1.4. QRA Deliverables, 
The scope of work must define the deliverables of the study and shall include the followings: 
* Hazard identification (potential hazardous events), 
© The incident scenarios, include the causes, and the consequences/impact analysis, 
e Estimate the likelihood of events, 
e Risk estimation and evaluation, for both indoor and outdoor populations / vulnerabilities, in 
terms of: 
o Societal Risk (PLL and FN curve), 
© Individual Risk (LSIR and IRPA), 
Revision No.: 01 Page 10 of 50 


EGPC 


QUANTITATIVE RISK ASSESSMENT QRA GUIDELINE 


o The cumulative Risk at different Risk ranking points, 
Proposal for Risk-reduction measures, 
The sensitivity study, (if it is required to be performed), should be considered in the study 
deliverables. 
Re-evaluation the Risk considering the study recommended Risk reduction measures (i.e. to 
rerun the results and re-evaluation the Risk after agreeing the suggested reduction measures 
with the Company, to assure the effectiveness of these measures to reduce the Risk to ALARP). 
(Note: Annex D — Tables D1 & D2 give a full list of the QRA study deliverables) 
8.1.5. Boundaries of the QRA, 


The boundaries of the QRA should clearly define which facilities’ hazards and personnel (including 
neighboring facilities) are to be included, or excluded, from the study, (Note: With consideration to 
7.2.21). 


8.1.6. Requirements, 


The following requirements shall be considered for the study: 


Must be based on a realistic analysis of the potential hazards, 

Must include an accurate estimate of the potential level of harm and likelihood, 

Must be followed by comparison results to the EGPC & Holding Companies’ Quantitative Risk 
Tolerability Criteria, 

Conclusions have to be drawn on the level of Risk and the need or not for change/improvement, 
Written down so that the enforcing authority can audit it, 

The software to be used for the QRA should be valid, internationally recognized, and licensed. 
The software name, version, license number, and the software validation certificate should be 
provided by the Consultant. 

The Company, according to its system, has the choice to require a number of the study copies in 
hard and/or soft form. 

The Company shall require and archive the study native file, to make it easier and faster to run 
any required integration or any future changes in the revalidation process. 

The quality of the assessment and the acceptability of the conclusions will reflect the Company's 
commitment to Risk management and regulation(s). 

8.1.7. Identification of Resources, 

The QRA Consultant to develop a schedule to breakdown the QRA activities , responsibilities and 
the deadline for each activity (end point), 

The QRA Consultant to submit the details of all personnel who will work and assist with the QRA 
activities, the Company has the full right to check the CV’s of these personnel to check their 
knowledge and capabilities to execute the QRA. 

8.1.8. Kick-Off Meeting, 


A kick off meeting shall be held between the Company and the QRA Consultant, or internally among 
the concerned department if the study will be executed internally in order to: 


Discuss the study scope of work in details, 

Check the study required data which should be availed by the Company (e.g. PFD, P&ID’S, 
process data, design data, ...) , and to discuss alternatives for missing data (if applicable), 

Submit the EGPC & Holding Companies’ Quantitative Risk Tolerability Criteria to the Consultant, 
and any other required, Entities or Company standard , and guidelines, 

Determine the site visit date, if required, 

Any other requirements. 
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8.1.9. Finalize the Scope, 
It is essential to finalize the scope of work following the kick-off meeting considering the followings: 


¢ The final scope may be modified to add any additional or missing requirements agreed through 
the meeting, 

e State for the Company available data and the alternative for the missing (if applicable), 

e The site visit final date (optional), 

e The assumed and agreed final Risk ranking points, 

e The study endpoint date. 


8.2. Assumption Register 


After the kick-off meeting and finalize the scope of work between the Company and the Consultant, 
the Consultant shall establish the study’ Assumption Register to show: 


e The study different assumptions, 

e The available data to be used, 

e The missing data (if any) alternatives and assumptions, 
e The references to be used, 


The QRA will contain several assumptions: these assumptions shall be listed in the QRA report so 
that results are fully traceable and repeatable and so that it can be verified that the assumptions 
reflect site reality. 


All assumptions used in QRA should be developed on a “conservative best estimate” basis. All 
assumptions made during the QRA shall be documented, reviewed and approved by the Company 
prior to use. The Company approval on the Assumption Register is permission for the Consultant to 
start the study activities. 


The register shall contain the assumptions for at least the following sections (Note: Some sections 
could be merged if applicable): 
Failure Case Definition (Identification of potential Loss Of Containments- LOCs) 
© Parts Count / Isolatable Sections 
) Release Location and Orientation (Direction) 
Consequence Assessment — Discharge 
c Physical Effect Potential Outcomes 
c Impact Assessment Criteria 
f Consequence Results Height of Interest 
0 Indoor / Outdoor Vulnerability 
Process/Model Assumptions 
Leak Frequencies and Hole Sizes 
Event Trees 
Ignition Probability 
« Explosion Modelling 
Manning Distribution 
Meteorological Data 
Modification Factor(s)/ and other Judgemental Assumption(s) (if used) 
Risk Calculation 
o Risk Acceptance Criteria 
© Sensitivity Analysis (if required) 
The Study Deliverables. 
Software to be used name, version and license number 
References. 
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8.3. Hazard Identification 

All potential Major Accident Hazards associated with the facility or operation shall be taken forward 
for QRA assessment. The potential hazardous event is usually called the ‘top event’ (e.g. 
hydrocarbons leaks from process equipment, storage facilities, risers or pipelines). 


Generally, there are two types of considered hazards, process and non-process: 


Process hazards generally consist of onshore/offshore process facilities, storage facilities, 
piping/pipelines, etc. 

Non-process hazards consist of occupational hazards, transportation Risk, escape and evacuation 
Risk, ship collision, dropped object, etc. 


Hazard Identification and failure case development techniques such as HAZID, HAZOP, & Methodical 
Leak/Rupture, along with the Company Major Accident Hazard (MAH) list are used to identify the 
Major Accidental Hazards associated with project facilities. 

(Note1; Choice of suitable technique is driven by the objective of the QRA, e.g. Preliminary Hazard Analysis 
can be used for a simple QRA but would not be suitable for a comprehensive QRA, and likewise, a methodical 
leak/rupture is suitable for the comprehensive and would be overkill for a simple QRA) 

(Note2: Reference should also be made to accidents and incidents that have occurred in the oil and gas 
industry and that are relevant to the Company operations.) 


Hazard Identification contains the main following steps: 


Review site all materials and identify those that are hazardous, 

Review process, utilities, and storage PFD’s to identify areas of concern, 

Identify the Isolatable Sections: Hazardous Events shall be defined in terms of the Isolatable 
Sections and their operating conditions. Isolatable sections are defined and bounded by the 
location of, Emergency Shut-Down Valves (ESDVs), Locked close manual valves, check valves 
rated for the maximum Pressure, and pumps / compressor that will tripped upon fire /leak 
scenario, (Note: Special consideration shall take place to the effect of presence of: Emergency 
Depressurization Valves (EDPVs), Control Valves, different materials compositions and phases, and 
different operating parameters). The isolatable sections shall be clearly marked on the P&ID, 
Identify the Hazardous Inventories (Inventory Analysis) for each Isolatable Section, 

Determine the Source Terms for all accidental events, the Source Term means the rate at which 
hazardous material reaches the environment and the conditions of the material (e.g. 
temperature, composition). 

8.3.1. Developing the Failure Case (Accident Scenarios) 


Once the hazards are identified, the Accident Scenarios for the QRA can be generated; 


Failure Cases Development Hazard 


(Accident Scenarios) Identification 


Figure 2: Failure Case Development inputs 


Failure cases are identified for the following categories: 


Pipework, risers, valves, flanges, fittings and associated equipment 
Pressure vessels / tanks 

Atmospheric storage tanks 

Intermediate bulk containers 

Pipelines 

Flexible hoses 
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Failure cases are distinguished from each other by the following conditions: 


¢ Release location: it is necessary to account for release location when defining failure cases, as 
the Risks to personnel depend on where they are located with respect to failure case locations. 

e Process parameters: temperature and pressure can have a significant impact on initial leak rate 
and subsequent consequences. 

e lsolatable section: the action of isolation valves and size of isolatable inventory affects the 
release rate profile and duration of release. 

* Material / phase released: the behavior of leaks, and therefore the subsequent consequences, 
can vary significantly according to the fluid phase. 

(Note: The Failure Cases shall be developed for each Isolatable Section based on the different previous 

conditions to capture appropriate Risk profile and release events.) 
8.3.2. Developing the Failure Cases using the Methodical Leak/Rupture 

When using the Methodical Leak/Rupture approach for Failure cases development, it is common to 

use the hole size categories, (within each range, a representative size will be assigned for the 

Consequence Modelling failure Case): 


e Small: 1mm to 10mm size hole, 

« Medium: 10mm to 50mm size hole, 
e Large: 50mm to 150mm size hole, 
e Rupture: > 150 mm, 


8.4. Consequence Assessment 
8.4.1. Failure Cases (Accident Scenarios) Possible Outcomes 


The development of the top event into a serious incident gives estimation for the expected failure 
cases (accident scenarios), the outcomes depend on: the effect of the process parameters, the 
release hole size, the phases of the hazardous material, the elevation and direction of the release 
point, the safety systems, the weather conditions, the confinement and congested areas, and 
presence of ignition sources. QRA studies use Event Trees to model the chronological series of 
events. Event Tree provides a systematic method to ensure all potential outcomes as a result of a 
specified top event are identified. Development of credible accident scenarios using Event Trees 
provides a structure to the conceptual and physical escalation scenario analysis. 


The possible outcomes from different hydrocarbons releases are: 
e Flash Fire 


A flash or cloud fire occurs when a cloud of gas burns without generating any significant 
overpressure. The cloud is typically ignited on its edge, remote from the leak source. The 
combustion zone moves through the cloud away from the ignition point. The duration of the flash 
fire is relatively short, but it may stabilize as a continuing jet fire from the leak source. The major 
hazard to people for those within the burning envelope (including those who might be above on 
elevated structures). Flame duration and intensity for most flammable clouds are insufficient to 
cause a significant thermal radiation hazard outside the flame envelope. Where congestion or 
confinement exists, flame speeds can accelerate to hundreds of m/s and overpressure effects will 
result in an Explosion. 
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e Jet Fire 


A jet fire is a turbulent diffusion flame, resulting from the combustion of a fuel continuously released 
with significant momentum in a particular direction (i.e. a jet). The flame can emit fatal levels of 
radiant heat to the surrounding area. Jet fire events are considered to occur following the 
immediate ignition of a continuous release involving flammable gases. 

© Pool Fire 

A pool fire is a turbulent diffusion flame burning above a horizontal pool of vaporizing flammable 
liquid, with little or no momentum. The flame can emit fatal levels of radiant heat to the surrounding 
area. Pool fire events are considered to occur following the ignition of a release (continuous or 
instantaneous) of hydrocarbon liquids, where a substantial liquid fraction remains following the 
release. When first ignited, the fire spreads rapidly across the full extent of the hydrocarbon pool 
and proceeds to consume the liquid at a characteristic burning rate. For a continuous release ignited 
early, the pool fire grows until equilibrium is reached where burning at the surface just balances the 
release rate. 


e Explosion (VCE - Vapor Cloud Explosion) 


A Vapor Cloud Explosion (VCE) occurs following the ignition of a flammable vapor cloud mixed with 
air in a congested area. Within the congested area, the flame accelerates to velocities high enough 
to produce significant levels of overpressure, which could then cause fatalities. VCE events may 
occur following the delayed ignition of a release (continuous or instantaneous) of flammable vapor 
or following vaporization of a liquid release. Several features need to be present for a vapor cloud 
explosion with damaging overpressure to occur: First, the released material must be flammable and 
at suitable conditions of pressure or temperature. (Such materials include liquefied gases under 
pressure: ordinary flammable liquids particularly at high temperatures and/or pressures: and non- 
liquefied flammable gases). Second, a cloud of sufficient size must form prior to ignition (dispersion 
phase). (Note: /f ignition occurs instantly, a large fire, jet flame, or fireball may occur, but significant blast- 
pressure damage is unlikely. While if the cloud be allowed to form over a period of time 
(1-5 minutes) within a process area, then subsequently ignite, blast pressures that develop can result in 
extensive, widespread damage, ignition). Third, a sufficient amount of the cloud must be within the 
flammable range of the material to cause extensive overpressure. (Note: The portion of the vapor cloud 
in each region depends on many factors, including type and amount of the material released: pressure at time 
of release: size of release opening: degree of confinement and congestion: and wind, humidity, and other 
environmental effects. In these appropriate conditions, a vapor cloud will generally have three regions: A rich 
region near the point of release: A lean region at the edge of the cloud: and A region in between that is within 
the flammable range). Fourth, the blast effects produced by vapor cloud explosions can vary greatly 
and are determined by the speed of flame propagation. In most cases, the mode of flame 
propagation is deflagration. Under extraordinary conditions, a detonation might occur. 

e Fireball / BLEVE (Boiling Liquid Expanding Vapor Explosion) 

A fireball is a burning fuel-air cloud, whose energy is emitted primarily in the form of radiant heat. 
Fireballs were considered to occur following the immediate ignition of large vapor releases. They 
were also considered possible following the immediate ignition of a large release of liquefied gas. 
(Note: Radiation effects due to the fireball depend on: The diameter of the fireball as a function of time and 
the maximum diameter of the fireball: the height of the center of the fireball above its ignition position as a 
function of time (after liftoff): the surface-emissive power of the fireball: the duration of combustion). As 
combustion must progress inwards, and this takes from 15 — 45 seconds depending on size, these 
fire events tend to rise during the event due to buoyancy effects. Normally, a fireball refers to 
combustion of a gaseous undiluted flammable cloud (i.e. pure hydrocarbon) and a BLEVE (Boiling 
Liquid Expanding Vapor Explosion) to the same event for liquids (also undiluted hydrocarbon). 
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These both result in rapid combustion from the edge inwards as air progresses into the hydrocarbon. 
A BLEVE has an associated overpressure due to the rapid expansion of the flashing liquid, whereas a 
fireball may have no associated overpressure. In general terms, transient thermal radiation from a 
BLEVE is more significant to people than the overpressure, but a small number of large fragments 
can be thrown large distances, beyond the thermal and overpressure hazard zones, and are also a 
small Risk. Fireball or BLEVE's effects will be determined by the condition of the line or vessel’s 
contents and of its walls at the moment of failure. These conditions also relate to the cause of 
container failure, which may be: external fire, mechanical impact, corrosion, overpressure, 
metallurgical failure. 

e Flammable Gas Dispersion 

Releases of gas (or gas flashed from liquid releases) form clouds that are dispersed by the initial 
momentum of the release, turbulence around the obstructions, natural ventilation, and the wind. 
The sizes of these gas clouds above their lower flammable limit (LFL) are important in determining 
whether the release will ignite. For toxic gas releases, the sizes of the clouds determine the zones 
within which fatalities may occur. Dispersion describes the process by which hazardous material 
released into the atmosphere is diluted by the air and transported away from the source. The degree 
of dilution is dependent upon the amount of turbulence present, either in the atmosphere or 
generated by the released material itself. The process of dispersion may be understood as changes 
in a number of key properties of the cloud: movement of the cloud downwind from the release 
point, spreading of the cloud, dilution of the cloud by entraining air, change of height of the cloud 
above the ground. A cloud released instantaneously is carried by the wind bodily away from the 
release point and spreads out in all directions. A continuous release forms a plume which spreads 
sideways as its front edge travels away from the release point with the wind and initial release 
velocity. If the release stops within the timescale of interest, the plume will detach from the release 
point and continue to spread and move downwind. The dispersion of a cloud of released material is 
controlled, fundamentally, by two properties of the cloud and two of the atmosphere: 

Cloud Properties: (a) Density, (b) Velocity relative to the surrounding air, 

Atmosphere Properties: (a) Wind speed, (b) Stability). 


* Toxic Gas Dispersion, (see Flammable Gas Dispersion) 


Figure 3 shows examples for possible outcomes from gas and liquid release events. (Note: The 
only case not included in Figure 3 is that of BLEVE (Boiling Liquid Expanding Vapor Explosion), which refers 
to the failure of a pressure vessel as a result of its external heating from a fire.) 


* Accordingly, for each identified Isolatable Section and Failure Case, the physical effects 
(consequence) shall be identified (Section 8.4.2.). 

e (Annex A — Table A1 gives an example and sample for the Process Hazards, Events, Sequences, 
Incident Outcomes, and consequences [1]). 
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Figure 3: Example for possible outcomes from gas and liquid release events (Ref. [7] - with adaptation) 


8.4.2. Physical Effect Modelling 


The Physical Effect refers to the possible consequences from releases of hydrocarbons and toxic 
gases. (For example, this may be the extent of a gas cloud's flammability or toxicity or it may be a 
measure of thermal radiation or explosion overpressure). Figure 4 shows the stages of developing 
the Hydrocarbons (HC) release into the main physical effects (Toxic, Flammable, and Explosion). 


Weather 
conditions 


HC Release 


(parameters) 


Figure 4: The stages of developing the HC releases into the main physical effects 
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Physical effects shall be calculated to identify which parts of the facility, community, Company 
personnel and the public may be exposed for each potential event and the extent of that exposure. 
This exposure used to estimate the potential for further failure, escalation, impairment, injury, etc. 
and contribute to decisions on the need to reduce such Risks. 

Once the release rate has been estimated the calculation of physical effects will depend on many 
other factors (such as: wind profile, obstruction, congestions, ignition sources, exposure duration,). 
The physical effect modelling determines the dispersion profile and extend of various physical effect 
such as toxic/ flammable dispersion, flash fire envelope, jet fire, pool fire, explosion effect, smoke 
dispersion, etc. 

The potential outcomes of various ‘physical effects’ for a given release profile for each scenario 
under consideration shall be reported in the QRA Report. 


Table gives list of the possible physical effects (consequences) apply for each failure case category. 


possible physical effects 


Failure case category 


Jet fires 
Fireballs 


Flash fires 
Explosions 


Pool fires 


1. Pipework, risers, valves, flanges, 
fittings and associated equipment 


2. Pressure vessels / tanks 


3. Atmospheric storage tanks 


4. Intermediate bulk containers 


5. Pipelines 


6. Flexible hoses 
Table 1; the probable physical effects which apply for each failure case category (Ref. Typical Industry Practice). 


The following list gives indicative values/scales at which the physical effects could be measured (these 
measures, as well as the vulnerability given values (Annex B), to be used for estimating the probable 
physical effect and its impact on human for emergency cases): 
8.4.2.1. Jet Fire: 
Release rate, jet flame length, Surface Emissive Power (SEP), downwind distance to 1.6kW/m2, 
4.7kW/m2, 6.3kW/m2, 12.5kW/m2 and 37.5kW/m2. 
In addition, radiation levels at the various onsite and offsite considered populations (indoor and 
outdoor) shall be reported. 
8.4.2.2. Pool Fire/Sea Pool Fire: 
Release rate, pool diameter, SEP, downwind distance to 1.6kW/m2, 4.7kW/m2, 6.3kW/m2, 
12.5kW/m2 and 37.5kW/m2. 
In addition, radiation levels at the various onsite and offsite considered populations (indoor and 
outdoor) shall be reported. 
8.4.2.3. Fireball/BLEVE: 
Fireball radius, BLEVE radius, downwind distance to 1.6kW/m2, 4.7kW/m2, 6.3kW/m2, 
12.5kW/m2 and 37.5kW/m2. 
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In addition, radiation levels at the various onsite and offsite considered populations (indoor and 
outdoor) shall be reported. 

8.4.2.4, Flammable Gas Dispersion Results 
Distance 0.5 LFL (Lower Flammable Limit), LFL and UFL (Upper Flammable Limit), (At all points 
and heights of interest (e.g. HVAC inlet, sources of ignition, EER measures (Evacuation, Escape 
and Rescue activities), etc.)). 

8.4.2.5. Toxic Gas Dispersion Results 
Distance downwind represents specific adverse health effect, on various considered populations 
onsite and offsite, from specific concentration of toxic material for various exposure times, 
(more details are given in 8.4.4.3, and Annex B (B) & Annex B (B-3)). 

8.4.2.6. | Smoke (mostly for offshore facilities): 
CO, CO2 concentrations at, downwind distance to various effective concentrations (more details 
are given in IOGP Report no. 434-14). 

8.4.2.7. Explosion Overpressure Results 
Downwind distance to 30mbar, 7Ombar, 100mbar, 200mbar, 300mbar and SOOmbar. 
In addition, explosion overpressure and impulse duration at the various onsite and offsite 
considered populations (indoor and outdoor) shall be reported. 

8.4.2.8. Bund Fire/Rim Seal Fire/Full Surface Fire 
Diameter, SEP, downwind distance to 1.6kW/m2, 4.7kW/m2, 6.3kW/m2, 12.5kW/m2 and 
37.5kW/m2. 
In addition, radiation levels at the various onsite and offsite considered populations (indoor and 
outdoor) shall be reported, 


Physical Effect Notes: 

(1) Justification for the selected SEP shall be furnished/ provided for the pool fire (land/sea) scenarios. 

(2) For the pool fire: the drainage system limits the pool size and reduces the impacts of its consequences 
(e.g. from evaporation from pools, or overly-large pool fires). The QRA software models typically do not 
have capability to model a drainage system. The Consultant must use his judgement and to agree with the 
Company to determine the pool credible size to avoid the exaggerated conservatism in results. 

(3) Bund fire and full surface fire scenarios considering credit for the smoke. 

(4) Radiation levels, flammable concentration and toxic concentration (H2S and SO2) shall be reported at 
various populations identified for the new facilities and existing facilities (if any). 

(5) Explosion overpressure results along with associated impulse duration shall be reported for the critical 
buildings, non-critical buildings, and manned/unmanned buildings. 


8.4.3. Height of Interest for Consequence Results 

The consequence results should be extracted at certain height, called height of interest, the results 

may be quite different at each height due to the behaviour and properties of different 

consequences. The following is the recommended guide for the consequence results different 
height of interest, otherwise should be justified by the Consultant and agreed by the Company: 

© All consequences effects on people shall be calculated at 1 meter above ground level, 

e For ingress into buildings, the concentration shall be monitored at the building openings heights 
(e.g. air intake, windows, unsealed and non-closed doors), where such information is not 
available, 2m & 3m heights to be considered, 

© For multi-story units, heights shall be based on where major equipment are located, 

e All other equipment can be considered at ground level. 
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8.4.4. Impact Assessment & Vulnerability of Human 


As part of impact assessment, vulnerability of humans to the consequences of major hazard events 
at onshore and offshore installations, primarily those producing and/or processing hazardous fluids 
are established. The focus is on Fatality Criteria as QRAs generally address fatality Risks: however 
injury thresholds can also identified where appropriate. 
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Figure 5: The stages of developing the HC releases into the Impact assessment 


The impact assessment is generally expressed in terms of: 

a) Lethality, which is fraction/percentage of the exposed population who would suffer fatality on 
exposure to a given consequence level. 

b) Probit, which is a function that relates lethality to the intensity or concentration of hazardous 
effect and the duration of exposure. 

Generally, the following consequences are considered as part of impact assessment: 

Fire Scenarios (radiation levels) 

Explosions (blast overpressure) 

Toxic Gases (toxic gas exposure) 

Smoke (toxic fumes exposure) 

8.4.4.1. Fire Scenarios: 


Humans are vulnerable to fire in the following ways: 


o Engulfment by the fire 
© Thermal radiation from the fire (outside the fire) 
o Inside a building that is exposed to fire/radiation 


The relation between fire type and potential vulnerability illustrated in Table 2 


Potential Vulnerability 


Fire Type 
\enguifment | Raition _|_insie Building 
Fash Fire ; — Ta 


Pool Fire 
Fireball/BLEVE 


Table 2: Impact Assessment of Fire type (Ref. [2]) 
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8.4.4.2. Explosion: 
Explosions generate overpressures and drag forces that in turn result in damage to buildings and 
structures, and generate missiles (fragments of damaged structures, window glass shards, or 
loose objects). The effects of overpressure on humans are normally categorised as follows: 
© Direct or Primary: injury to the body as a result of the pressure change 
© Secondary: injury as a result of fragments or debris produced by the overpressure 
impacting on the body 
o Tertiary: injury as a result of the body (especially the head) being thrown by the explosion 
drag and impacting on stationary objects or structures. 


For QRA, lethality is not typically estimated independently for these effects: instead, an overall 
lethality is estimated based on the combination of these effects. Casualties requiring medical 
treatment from direct blast effects are typically produced by overpressures between 1.0 and 3.4 
bar, However, other effects (such as secondary effects and thermal injuries) are so predominant 
that casualties with only direct blast injuries make up a small part of an exposed group. 

8.4.4.3. Toxic: 


Various approaches are used to determine the consequences of toxic gases and have various 
purposes: 

© IDLH (Immediately Dangerous to Life or Health), 

© ERPG/AEGL (Emergency Response Planning Guideline / Acute Exposure Guideline Level), 

© Probit, (recommended to be used for Risk Calculations, as it takes into account both 

concentration and duration of exposure). 
© SLOT (Specific Level Of Toxicity), DTL (Dangerous Toxic Load) & SLOD (Significant 
Likelihood Of Death). 

Toxicity Notes: 
(1) IDLH (“immediate Danger to Life or Health”) is the maximum concentration from which escape is 
possible within 30 minutes without any escape-impairing symptoms or irreversible health effects. It used 
as the limiting value for the onset fatalities. 
(2) ERPGs — Emergency Response Planning Guidelines — they are used (in the USA) to plan emergency 
response to an incident, knowing the likely ranges of health effects resulting from the incident and 
consequent numbers of casualties. 
(3) The probit approach has been used with probit functions being developed for a wide range of toxic 
materials. They enable the lethality to be estimated for any combination of concentration and duration of 
exposure, including time dependent concentrations (resulting from time varying release rates). They are 
recommended to be used to provide fine resolution in fatality estimates, especially for third party (offsite) 
Risks onshore. 
(4) The SLOT (Specified Level Of Toxicity) DTL (Dangerous Toxic Load) is usually defined as the dose that 
results in highly susceptible people being killed and a substantial portion of the exposed population 
requiring medical attention and severe distress to the remainder exposed. As such it represents the dose 
that will result in the onset of fatality for an exposed population (commonly referred to as LD1 or LD1-5). 
(5) The SLOD (Significant Likelihood of Death) DTL is defined as the dose to typically result in 50% lethality 
(LD50) within an exposed population and is the value typically used for group Risk of death calculation 
onshore. 
(6) The SLOT and SLOD DTLs technique has been proposed and developed by the UK HSE as an alternative 
to the probit approach. 
(7) The use of probits approach is recommended. 
(Annex B — Gives details to determine and understand the different values of Vulnerability of Human for 
different Consequences/Impacts of Major Hazard Events). 
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8.5. Frequency Assessment 
8.5.1. Parts Count (Equipment Count) for Isolatable Sections: 
For each failure case, in each isolatable section, equipment is counted to provide input to 
estimating leak frequencies. This is known as a ‘parts count’. 
The frequency of each leak scenario and size identified is estimated by combining parts counts for 
each equipment item with Leak frequencies. 
A ‘parts count’ involves counting each and every equipment item in each section identified as set 
out in but not limited to: 
e PFDs 
© = P&IDs 
e Equipment list 
e Layouts and plot plans 
For equipment (pipework, risers, flanges, valves etc.) where the release frequency is 
line/connection diameter dependent, a separate count is made for each such diameter. The P&IDs 
are marked-up as equipment is counted to ensure that every item has been included. 
8.5.2. Hazardous Events Likelihood 
There are two basic forms that the likelihood of an event may be expressed: 
e Frequency: number of events or outcomes per defined unit of time e.g. a Ginch ESD valve has a 
failure frequency of 10-4 times per year 
* Probability: measure of the chance of occurrence expressed as a number between O and 1, 
where 0 is impossibility and 1 is absolute certainty. 
The Quantitative estimates of hazardous events likelihood are usually derived using a combination 
of the following approaches: 
8.5.2.1. Plant/Facility Specific Data 
Failure rate data generated from collecting information on equipment failure experience at a 
plant are referred to as plant-specific data. A characteristic of plant-specific data is that they 
reflect the plant's process, environment, maintenance practices, and choice and operation of 
equipment. 
One advantage of using plant data is that it already encompasses all common relevant 
contributory aspects including the reliability of equipment, human factors, maintenance, 
operation, operational methods, quality of construction and inspection, for the facility itself, the 
plant/facility Data are: 
© based on previous experiences 
o database with regular updates 
8.5.2.2. Generic Failure Frequencies 
Data accumulated and aggregated from a variety of plants and industries are called Generic 
Data, (sometimes are called Historical Data). With inputs from many sources, generic failure rate 
data can provide a much larger pool of data. However, generic data are derived from equipment 
of many manufacturers, a number of processes, and many plants with various operating 
strategies. Generic failure rates/ frequencies for various components are available in various 
historical accidental databases such as IOGP, OREDA, UK HSE HCR, Purple Book, etc. These 
frequencies in conjunction with parts count, hole size, and distribution are used to determine the 
failure frequencies. 
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Notes: 
(1) When using the Generic Failure Frequencies data, it usually gives conservative results, and to avoid 
obtaining exaggerated failure data due to the differences between the conditions of the QRA study 
facilities (e.g. design and operating conditions), especially for the new facilities (which usually come with 
new design and technology), and the multisource of the generic data, the QRA Consultant, after making 
an engineering judgment, can use modification factor(s) to make the failure data more suited to the 
facilities under the study. 
(2) Decreasing the time of getting the facilities in service (usage time), using the safety system(s) to 
decrease the inventories and the time of the facility’ blowdown, shall also be reflected on the failure 
frequencies. 

8.5.2.3. | Using Modelling Techniques 
Modelling techniques to estimate incident frequencies from more basic data are used when 
suitable historical data are not available or are inadequate. Various techniques are available, but 
the most common and widely used techniques are Fault Tree Analysis (FTA) and Event Tree 
Analysis (ETA). 

8,5,2.3.1, Fault Tree Analysis (For Top Event Frequency Estimation) 

Fault Tree analysis is a common probabilistic technique widely used in system reliability and 
safety studies, It allows the user to concentrate on a particular system failure, which usually 
gives rise to the 'top event'. Fault Tree analyses are performed using a top-down approach. 
Starting with a top-level event, Fault Tree analysis is performed by working down to evaluate all 
the contributing events that may ultimately lead to the occurrence of the top-level event. The 
resulting Fault Tree diagram is a graphical representation of the chain of events in the analysed 
system or process, built using events and logical gate configurations. The probability of the top- 
level event can then be determined by using mathematical techniques. By ascribing frequencies 
to each basic cause, the frequency of the Top Event can be calculated. This requires knowledge 
of basic cause failure rates. The best practice in selecting basic cause failure rates should be the 
use of supplier data for new installations and of historical data of the plant for existing 
installations. There are also a number of generic databases available which assign basic cause 
failure rates. Throughout the construction and analysis of Fault Tree, assumptions will also have 
to be made regarding the ways in which the facility is operated and maintained. These 
assumptions (repair rates, inspection time, etc.) should be set out together with the project 
Maintenance group. 

o Top event is the accident and broken into its component causes 

© Frequencies come from historical data and informed judgement 

8.5.2.3.2. Event Tree Analysis (For Failure Cases Probability Estimation) 

Event tree analysis (ETA) is an analysis technique for identifying and evaluating the sequence of 
events in a potential accident scenario following the occurrence of an initiating event. 
ETA utilizes a visual logic tree structure known as an Event Tree (ET). The objective of ETA is to 
determine if the initiating event will develop into a serious mishap. An ETA can result in many 
different possible outcomes from a single initiating event, and it provides the capability to obtain 
a probability for each outcome (failure case). (Note: For the most of modern complete QRA software 
the Event Tree is built-in the software), ETA Diagram structure illustration is shown in figure 6, 
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Failure (29) 
Failure Outcome F 
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Figure 6: ETA Diagram structure 


The main nodes of the Event Tree are mainly relevant to the probability of ignition 
(immediate/delayed) and probability of explosion, the event frequency of each incident scenario 
(consequence) is derived by multiplying the failure frequency by the probabilities along the Event 
Tree branches that lead to that scenario. (Note: The failure frequencies are expressed as a frequency 
(e.g. number of occurrences per year). The event probabilities are real probabilities (i.e. a dimensionless 
number between 0 and 1)). 

(Annex C - Figures C1-C5 provide examples for Event Tree for a range of different release types) 

8.5.2.4. Judgemental Evaluation 


When historical data is not available, or only available for facilities operating in different 
circumstances, it is necessary to use engineering judgement or rely on the opinion of experts to 
interpret data for comparable equipment in order to make a best estimate. Such judgements 
should not be too optimistic and should be clearly recorded and formalized as part of 
assumption register. 

o Occurrences are rare and/or data is not available 

o May be suitable for basic Risk assessments 

8.5.2.5. Software 


A numbers of software are also available for the frequencies estimation, these software 
programs use a combination of the previous failure frequency approaches. 


Revision No.: 01 Page 24 of 50 


QUANTITATIVE RISK ASSESSMENT QRA GUIDELINE 


8.5.3. Frequency Estimation 
The failure frequency for each failure case for each isolatable section needs to be represented by 
one frequency value (e.g. it would consider all large leaks from all the base elements in each 
isolatable section as they are all part of the single failure case for this isolatable section). Failure 
frequencies are applied to all items of equipment (e.g. pipes, flanges, valves), within the failure 
cases (as they are all part of the single failure case). 
The failure frequency for the failure case is the sum of the failure frequencies of the base elements 
multiplied by the number of base elements. 2 
In general the failure case frequency is given by this simple equation: F= y nifi 
Where: fel 

F is the frequency of incident. 

nj is the number of base elements i. 

fis the frequency of failure for base elements i 


8.6. Other Data for Risk Calculation 


In order to complete the Risk Calculation some other data should be collected, calculated, and 
considered (e.g. Process and Plant Data, Chemical Data, Environmental Data, [1]), hereafter some of 
the most important required data: 


8.6.1. Ignition Sources and Ignition Probability 


Personnel are normally more likely to be fatally injured if the release of flammable material is 
ignited. In order to account for the difference in Risk associated with ignited releases and unignited 
releases, it is necessary to determine the ignition sources and estimate the probability of ignition. 
As well as, the time at which a release is ignited has a significant influence on the corresponding 
consequences. The flammable gas leaks which are ignited immediately are likely to result in jet 
fires. (For clarification: UKOOA model is used to estimate the Immediate Ignition probabilities based 
on leak rates of flammable material. (e.g. assuming ignitions that occur within 30 seconds of a leak 
are classified as immediate, the probability of immediate ignition is taken to be 36% of the overall 
ignition probability). 
While, if flammable gas leaks are delayed in their ignition, there is likely to be a higher degree of gas 
build-up on the facility, resulting in a higher explosion Risk than leaks which are ignited 
immediately. The probability of delayed ignition occurring is dependent on a dispersing release 
encountering an ignition source, and is calculated according to the dispersion characteristics of each 
event (including the duration), the characteristics of the defined ignition sources. 
Ignition sources types differ from on site to out sites (e.g. ground flares, overhead electrical cable, 
on site human activities (hot work), out site human activities (cooking), vehicles, trains, etc.). (As an 
example for the ignition source defined on site, it is assumed to ignition probability, given that a 
flammable cloud overlaps the ignition source, is equal to 1). 
(Note: Guideline available from IOGP Report 434-06 shall be used for the Ignition Probabilities). 
(Note: For the most of complete QRA software, the ignition probabilities are built in the software and it is a 
matter of choosing the ignition sources location and types). 

8.6.2, Explosion Data 
The Explosion involves the release of flammable gas or vapor within a confined or highly congested 
area followed by a delayed ignition. A confined explosion can result in multiple fatalities as well as 
resulting in damaging overpressures on equipment and buildings (will be covered in the Fire and 
Explosion Risk Assessment (FERA) Guideline, (EGPC-PSM-GL-009)). The over pressure generated will 
depend on the degree of congestion and confinement of the area and the gas cloud size (mass). 
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EGPC | f eae 
Explosion probabilities are determined based on the overlap between LFL clouds and congested 
areas. 


It is necessary to define congested or confinement areas of the site which have the appropriate 
attributes for pressure generation. Congested areas can give flame acceleration and subsequently 
overpressure in the event of a flammable cloud within the congestion being ignited. Typical 
congested areas are process plant, vessels, tanks, and pipework. (Note: Areas in the open air e.g. over 
open ground or between large structures such as the storage tanks, are not regarded as congested or 
confined). 

8.6.3. Meteorological Data (Weather Conditions and Probabilities) 


Weather conditions at the time of the release have a major influence on the extent of dispersion. 
The primary factors are the wind speed and the atmospheric stability. Atmospheric stability is an 
estimate of the turbulent mixing: stable atmospheric conditions lead to the least amount of mixing 
and unstable conditions to the most. 

The atmospheric conditions are normally classified according to six Pasquill stability classes 
(denoted by the letters A through F). The stability classes are correlated to wind speed and the 
quantity of sunlight. 

During the day, increased wind speed results in greater atmospheric stability, while at night the 
reverse is true. This is due to a change in vertical temperature profiles from day to night. 

Within the stability classes, A represents the least stable conditions while F represents the most 
stable. (i.e. more stable weather conditions cause dispersing clouds to sustain for longer distances 
at higher concentrations. That can lead to greater flammable mass and higher toxic dose compared 
to less stable weather conditions). 

Pasquill Stability classes are: 


e Avery unstable — sunny, light winds 

¢ A/B unstable — as with A only less sunny or more windy 

¢ Bunstable — as with A/B only less sunny or more windy 

e B/C moderately unstable — moderate sun and moderate winds 

* Cmoderately unstable — very windy/sunny or overcast/light wind 
C/D moderately unstable — moderate sun and high wind 

D neutral — little sun and high wind or overcast/windy night 

E moderately stable — less overcast and less windy night than D 

F stable — night with moderate clouds and light/moderate winds 


During the day, increased wind speed results in greater atmospheric stability, while at night the 
reverse is true. This is due to a change in vertical temperature profiles from day to night. 

Within the stability classes, A represents the least stable conditions while F represents the most 
stable. (i.e. more stable weather conditions cause dispersing clouds to sustain for longer distances 
at higher concentrations). 

Table 3 - Meteorological Conditions Defining the Pasquil-Gifford Stability Classes (Gifford, 1976). 
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Daytime insolation Nighttime conditions Anytime 


Thin overcast or 23/8 Heavy 
Slight >4/8lowcloud cloudiness overcast 


Strong Moderate 


<2 B D 


A 


A-B FB 


¢ 


F 


Table 3: Meteorological Conditions Defining the Pasquil-Gifford Stability Classes (Gifford, 1976). (Ref. [1]) 


8.6.3.1. For the purpose of QRA study the following requirements for the weather 


conditions should be applied 


Two weather conditions are selected to represent the average wind conditions during the 
year considering the day and night conditions. 

The average weather conditions shall be calculated depends on at least the last five years 
weather conditions. 

Weather data should be based on data from Egyptian meteorological authority. 

In the absence of detailed meteorological data for a particular site, two common weather 
combinations (stability and wind speed) should be used, The UK-HSE recommends using 
two representative weather conditions to model the dispersion of each release scenario. 
Wind stability class 5D and class 2F: 


5D - neutral stability and 5 m/s wind speed. This is typical of daytime conditions with 
relatively high wind and cloud cover, leading to moderately turbulent conditions. 

2F - stable conditions and 2 m/s wind speed. This is typical of night-time conditions 
with moderate cloud cover, where there is limited turbulence and hence limited 
dilution of dispersing clouds. 


8.6.4. Population and Manning Level Distribution 


It is necessary to know the population distribution on and around the site to estimate the Societal 
Risk. However, it is still necessary to determine the location of the people whose Individual Risk is 
being estimated. 


a) Offsite Population: 


The population distribution is often defined as population density. Sources of population data for an 
area are census reports, detailed maps, aerial photographs, and site inspections by the analyst. 
Special attention must be made to the various types of population (i.e., residential or industrial), the 
indoor and outdoor percentage, and the day/night variations and concentrations of people such as 
hospitals, mosques/churches, or schools. 

(Note: Appropriate provision for future development is also important). 


In absence of enough data, typical population density estimates for different categories of 
occupancy are [1]: 

e Urban: 19,000-40,000 people/square mile 

e Suburban 5000-19,000 people/square mile 

e Scattered housing: 250-5000 people/square mile 
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b) Onsite Population/Manning Level: 


The manning level shall be identified for each worker group: it should be assigned a rotation/shift 
pattern, and the time spent at each area of the facility/plant versus time spent in the control 
room/offices/accommodation shall also be estimated. These estimates shall be used to calculate 
the Individual Risk in form of IRPA to each person within each worker group. 


8.7. Risk Analysis 


The consequences and frequencies are combined in an integrated QRA model to give numerical Risk 
values. (Note: Other non-process hazards also need to be analysed, such as personnel transport, 
occupational hazards, ship collision, aircraft impact and natural hazards. Each has its own specialist method 
for Risk Analysis). 

Risks to people may be expressed in two main forms: 

a) Individual Risk: 


The Risk experienced by a person and it shows the frequency at which an individual (worker or 
public) may be expected to sustain a given level of harm from the realization of specified hazards. It 
is usually taken to be the Risk of death and usually expressed as a Risk per year. It is divided into: 


© IRPA, Individual Risk Per Annum: Individual Risk mostly expressed in the form of Individual Risk 
Per Annum (IRPA). The IRPA is a representative worker of a given workers group considering 
expected occupancy at all the locations he is expected to be present within the hazardous 
location throughout the year. This includes plants, accommodations, recreational activities, etc. 
The calculation excludes the duration for which personnel is not present at the site due to 
reasons such as annual leave, personnel is considered not exposed to facility operations or 
occupational Risk during this duration. 

co LSIR, Location Specific Individual Risk / Risk contours: Risk contours are iso-Risk contours plot 
represent the geographical variation of the Risk for a hypothetical individual who is positioned 
at a particular location for 24 hours per day, 365 days per year. 

b) Societal (or Group) Risk: 

The Risk experienced by the whole group of people exposed to the hazard. Where the people 

exposed are members of the public, the term Societal Risk is often used. Where workers are 

isolated and members of the public are unlikely to be affected, the term group Risk is often used. In 
this document, the term Societal Risk is used to encompass both public and worker Risk. There are 
two forms of Societal Risk: 

o FN Curve / Diagram: The FN curve is the curve of cumulative frequency versus numbers of 
fatalities on a logarithmic scale. FN curves are frequency-fatality plots, showing the cumulative 
frequencies (F) of events involving N or more fatalities. 

© PLL, Potential Loss of Life: The other main measure for Societal Risk is the annual fatality rate, 
where the frequency and number of fatalities are combined into a Potential Loss of Life (PLL), 
which is a convenient one-dimensional measure of the total number of expected fatalities. 

8.7.1, Process Risk Presentation: 

Calculated process Risk shall be presented based on Risk various indicators as outlined in table 4 

below. 
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F-N Curve 
(Public) 


LSIR F-N Curve (Workers) 


- LSIR Contour 
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anchors isolatable each each administrative buildings / public 
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fs lative group group places / entertainment 
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Results illustrated in form of: 


For For 
each each 
worker | worker 
group group 


LSIR value for 
each deck 


Offshore 


- Contours on geographical maps or plot plan, graphs, curves, and 


- Tables shall be provided to show the Risk values for both indoor and outdoor 
vulnerabilities (for both onsite and offsite populations). 


Note 


Table 4: Process Risk Presentation- Risk various indicators 
(Annex D — Tables D1 & D2 give a full list of the QRA study deliverables) 


8.7.2. Other Risks Analysis 
8.7.2.1, | Non-Process Risk 


As part of non-process Risk assessment, following Risks are studied for various process 
facilities/installations, where applicable. 
0 Ship Collision Risk Assessment 
© Transport Risk Assessment 
o Dropped Object Risk Assessment 
o Occupational Risk Assessment 
8.7.2.2. Ship Collision Risk Assessment 
As part of the ship collision Risk assessment, it is important to determine the Risk of platform-ship 
collision under mainly 2 categories i.e. passing ship collisions and infield ship collisions. It is 
recommended to use guidelines available from |OGP Report 434-16 for the ship collision Risk 
assessment. (Note: If any specific information is to be considered, it shall be documented as part of the 
assumption register). 
8.7.2.3. Transportation Risk Assessment 
8.7.2.3.1. Marine Transport Risk Assessment 
Marine transport Risk is determined using the FAR rates. The FAR (fatalities per 1E8 exposed 
Hours) where crew boats are used to transport other personnel to and from offshore facilities is 
expressed as below: 
© FAR = 30 + (26/Transit Time Per Journey in Hours) 
(Note: This method is very high-level assessment but adopted for typical QRA report based on the 
guidelines given in IOGP Report 434 — 10). 
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8.7.2.3.2, Aviation Risk Assessment 
Aviation Risk assessment includes determination of Risk for helicopter and fixed wing transport 
Risk associated with facilities under consideration. 
The following methods are recommended. 
© Individual Risk (IR) per journey = In-flight IR + Take-off & landing (TO/L) IR 
e In-flight IR = Accident frequency in-flight (per hour) x Flight time (hours) x 
Probability of fatal accident x Probability of death in fatal accident 
© TO/L IR = Accident frequency in TO/L (per flight stage) x No of flight stages per 
journey x Probability of fatal accident x Probability of death in fatal accident 
8.7.2.3.3. Road Transport Risk Assessment 
Road transport Risk assessment shall be included to determine the Risk to people. Risk 
assessment to include Risk due to transportation and also due to transportation of hazardous 
material. 
8.7.2.4. Dropped Object Risk Assessment 
Where separate Dropped Object Study is carried out, any Risk to the people shall be considered in 
the QRA based on the calculated dropped object frequency and impact energy. 
8.7.2.5. | Occupational Risk Assessment 
Occupational Risk is associated with day to day activities (operation) of the facilities and is generally 
presented as FAR (Fatal Accident Rates). If It is required that as part of the QRA study, occupational 
Risk is calculated for the various workers group based on the time spend in the facilities (field) over 
the year. 
(Note: Guidelines available from |OGP Report 434-12 shall be used to determine FAR rates). 
8.7.2.6. Escape and Evacuation Risk Assessment 
Generally, escape and evacuation Risk are determined for the offshore facilities. 
The following shall be considered as minimum following escalation cases to be studied as part of 
the QRA Report if identified as Risk contributors to personnel. 
© Potential fatalities due to escalated scenario such as BLEVE, Fireball, Boil over, 
Catastrophic Vessel Failure, secondary explosion or toxic releases, etc. 
© Potential fatalities during evacuation such as use of lifeboat/ life raft/ rescue boat, 
impairment of muster location, impairment of TR, impairment of both the escape route 
etc. 
(Note: Guidelines are available in IOGP 434-19 for determination of evacuation Risk for various evacuation 
modes, evacuation scenario probabilities and evacuation frequency. Evacuation frequency shall be obtained 
by considering all the scenarios requiring evacuation). 
8.7.2.7. H2S Zoning 
Locations where a H2S hazard exists must be classified according to the potential threat from H2S 
based on the precautions needed to allow people a good chance to escape in the event of an 
accidental release of H2S. As part of the QRA Report, it is required that H2S zoning is carried out for 
facilities containing H2S or existing H2S zoning is updated to reflect the new facilities being added. 
8.7.2.8. | Occupied Building Risk Assessment 
It measures the Risk to people in occupied buildings in a process plant against the MAH impacts 
(fire, explosion, toxic, smoke impairment, etc.). The OBRA can help determining if the occupants of 
a building are being subjected to unnecessary Risk and identifying where additional protection 
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would be advised to eliminate, control, and mitigate the consequence(s) of any potential Major 
Accidents and to demonstrate that the Risk(s) is as low as reasonably practicable (ALARP). 


The MAH impacts shall be studied as part of the OBRA. Both the location and the design of occupied 
buildings can significantly affect the survivability of people inside buildings in the event of a Major 
Accident. The MAH impacts shall be studied for the residential buildings, accommodation buildings 
and industrial buildings which are either occupied or are used post emergency for EER measures. 
The overall summary of Risk assessment shall be made available in QRA Report. 


The Occupied Building calculated Risk represents an annual frequency that individual might be killed 
from a MAH while occupying a specific building. And it is calculated by multiplying the Building Risk 
with the fraction of individual occupancy in a specific building (e.g. 40 hrs. /week). 


The calculated Occupied Building Risk contribution to the Individual Risk is compared with the 
following Risk Tolerability Acceptance Criteria; 

0° 10-5/yr. for new buildings, 

© 10-4/yr. for existing buildings 
And the MAH impacts in the OBRA shall include the following: 

0. Flash fire, 

o O5LFL, 

© Heat radiation that leads to damage to the building based on building construction material, 

© Overpressure due to explosion that leads to damage to the building based on building 

construction material, 

0° Toxic gas AEGL 2 value at building. 
OBRA Notes: (Otherwise shall be justified by the Consultant and agreed by the Company): 
(1) Occupied Building is a Building that personnel occupy while doing a major part of their work, such as 
control rooms, laboratories, office buildings, maintenance work areas, outside operator buildings, or a 
building with a primary purpose that necessitates people to occupy it, such as field labs, lunch-rooms, locker 
facilities used to change clothes, showers, restrooms or toilets (lightweight plastic porta-toilets are excluded 
from this definition). 
(2) Other Portable Building that has a primary purpose to house or store equipment or materials are 
considered an “occupied building” if any of the following conditions apply: 

0 An individual spends on average 10 hours or more a week inside the building. 

0 100r more people are in the building at any given time. 

© Agroup spends an average of 200 exposure hours or more a week inside the building. 

0 The building is used for accommodation or sleeping. 
(3) Observation shelters provided for weather protection for the marine, road, or rail loading operator may, in 
consultation with the Company, be excluded from the definition of an occupied building. By nature, such 
buildings are small and require a large amount of window area to satisfy operational safety requirements 
with the loading operations. 
(4) If a building is required to be occupied in the event of emergency, in such cases, buildings shall be designed 
as TR (Temporary Refuge: is an enclosed place where people can muster whilst investigations, emergency 
response and evacuation preparations are undertaken). 
(5) The fire and Explosion Assessment for the building itself is carried out as part of the FERA study. 

8.7.2.9. Simultaneous Operations (SIMOPS) QRA 


Oil and Gas operations involve many simultaneous activities / operations where people can get 
exposed to significant Risk. Therefore, it is important that these activities and potential SIMOPS are 
looked at during the development of QRA study where information is available or a separate 
SIMOPS QRA can be conducted. 
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The two main examples for the SIMOPS are: 
© Two different operation activities conducted adjacent to each other (e.g. drilling activities 
conducted adjacent to live production or processing facilities). 
(For this case the Risk from both operation activities shall be combined). 
© Construction activities conducted adjacent to live production or processing facilities. 
(For this case Risk from existing production activity on construction personnel shall be studied and 
the QRA can be reviewed where available to determine the Risk to construction personnel). 
The SIMOPS assessment shall also consider additional precautions put in place for the duration of 
the SIMOPS and additional increases in Risk due to activities or presence of additional manpower. 
8.7.2.10. Integrated Risk Assessment 
Once various Risks such as process Risk, non-process Risk, escape & evacuation Risk, etc. are 
determined the overall Risk shall be determined by combining Individual Risk from all these factors. 
For brownfield or modifications projects/QRA, existing facilities Risk shall also be considered. 
8.8. Risk Evaluation 
Once Risks are identified and analysed, Risks should be evaluated against set Criteria. It must be 
ensured that all Risks are evaluated to meet and comply with EGPC and Holding Companies’ 
Quantitative Risk Tolerance Criteria. 
(Annex E — Shows the QRA Tolerance Criteria- as per mentioned in the Risk Management Standard 
EGPC-PSM-ST-001). 
8.9. ALARP Demonstration 
The QRA shall provide a clear demonstration that the Risk is (or will) be reduced to ALARP. 
ALARP process starts by identification of the Major Risk Contributors, These Major Risk Contributors 
are further broken down to determine the top contributors to Risk. 
Risk reduction measures are identified against these contributors to reduce the Risk, as well as 
identifying hierarchy of controls for these Risk reduction measures. 
The QRA Consultant shall: 
¢ Identify and provide Risk reduction measures to ensure the Risk is “As Low As Reasonably 
Practicable” (ALARP), 
¢ Demonstrate that the preferred Risk reduction measure reduces Risk to ALARP by rerun the 
results after agreeing the suggested reduction measures with the Company, (this will help to 
assure the effectiveness of these measures to reduce Risk to the ALARP). 
ALARP demonstration (including the Cost Benefit Analysis, if required), should be in accordance 
with the ALARP Demonstration Guideline EGPC-PSM-GL-010 & the Risk control measures option 
should be in accordance with the Risk Management Standard EGPC-PSM-ST-001 (7.7.Risk Treatment 
& Annex E- Risk Control Measures). 
8.9.1. Some options for Risk prevention and mitigation 
Risk is a combination of likelihood and consequence so Risk prevention and mitigation will influence 
one or both of these to reduce the overall level of Risk, the following practices gives some options 
for developing that: 
8.9.1.1. Option for mitigation and reducing of consequences 
o Plant siting and layout 
© Substitution of material 
e Using less flammable / less volatile / less toxic materials 
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o Reducing inventory (during design) / Active systems for inventory reduction (divert the 
inventory from process in case of accident). 
o Reducing severity of process conditions 
¢ Reduction of temperature/pressure may result in lower discharge rates in case of 
accidents 
o Limiting ignition sources 
o Emergency preparedness and response 
e Emergency plans and procedures 
*« Emergency protection systems (Using Passive and Active fire protection and fire 
fighting instruments). 


8.9.1.2. | Option for prevention and reducing of likelihood 
© Substitution of material 
e avoid use of hazardous materials and substitute with less hazardous ones (e.g. 
avoid use of corrosive material) 
co Reducing severity of process conditions 
« Use of lower process condition (temperature/pressure/..etc.) would reduce 
mechanical failure of the equipment 
o. Use of high safety factors 
« Increasing margin between design and operating conditions would reduce the 
likelihood of mechanical failure 
Asset Integrity Management Systems such as Risk Based Inspection (RBI) programmes 
Process interlocks and shutdown systems 
Improve the reliability of safety systems 
Effective safety management systems 
® Safe systems of work practice are in place 
* Hazards are identified and controlled 


oooo 


8.9.2. Sensitivity Analysis 
The Sensitivity Analysis generally takes place to fulfil ALARP Criteria. It is the act of analyzing the 
effect of output by changing one or more of the inputs to the system. It is often used when there is 
uncertainty in a particular input. (For example, a Sensitivity Analysis may be performed when trying 
to decide whether to store LPG using pressurized technology or refrigerated technology). The 
different obtained Risks provide the basis for the Risk management decisions making process. Some 
typical examples for the elements which can subject to Sensitivity Analysis are: 
e Leak frequencies 
Leak locations 
Ignition probabilities 
Wind data 
Operating conditions 
Release durations 
Vulnerability Criteria 
Population data 
(Note: The Sensitivity Analysis should be a part of the assumption register and the QRA report). 
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8.10. QRA Reporting 


QRA report shall document all the key assumptions, facility description, assessment details and all 
relevant calculations and information used in the assessment. The report shall be submitted in Hard 
and soft copy as per needed by the Company, and should be subjected to the document control 
procedure of the Company. The QRA report shall contain at least the following sections: 


Executive Summary & conclusion 

Section 1—Introduction/ Objective/Scope 

Section 2 — Facility Overview 

Section 3 - QRA Methodology 

Section 4 — Site Description 

Section 5 — Hazard Identification 

Section 6 — Failure Cases 

Section 7 —- Consequence Assessment 

Section 8 — Frequency Assessment 

Section 9 — Ignition Probabilities 

Section 10- Explosion Probabilities 

Section 11 — Weather Conditions 

Section 12— Manning Levels 

Section 13— Process Risk Assessment 

Section 14 — Non-Process Risk Assessment (if required) 
Section 15 — Integrated Risk Assessment 

Section 16 — Risk Results and Assessment (indoor and outdoor Risk results) 
Section 17 — Sensitivity Analysis (if required) 

Section 18 — Major Risk Contributor Analysis & Risk Reduction Measures 
Section 19 - ALARP Demonstration 

Section 20 — Conclusion & Recommendations 

Section 21 — References 


© Appendix 1 — Assumption Register 

. Appendix 2 — Plot Plans, Layouts, etc. 

. Appendix 3 —Isolatable Section & Failure Case Marking 
. Appendix 4 — Part Count and Failure Frequencies 


. Appendix 5 — Meteorological Data 

. Appendix 6- Populations densities 

. Appendix 7 — Inventory Calculations 

. Appendix 8 — Consequence Results (Flammable gas, fire and explosions) & Contours 
. Appendix 9—LSIR - FN Curves 

° Appendix 10 — Risk Ranking Reports 


(Note: It is up to the Company to require any of the appendixes to be part of the study body.) 
9. Action Plan 


Inconsistence with the Risk Management standard EGPC-PSM-ST-001, the following should be 
recorded and respond as action plan in the corresponding form: 


All the identified Risk reduction measures/recommendation shall be documented and clearly 
highlighted as part of action plan, and in the corresponding safety case. 

All QRA recommendations related to the engineering shall be closed prior to design is finalized. 
All QRA recommendations related to construction, fabrications, installations, commissioning etc. 
shall be closed out prior to carry out the operation. 
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e For existing operations, where QRA is carried out, facilities being in operations, certain 
recommendations may require much longer time to implement due to reason such as time when 
next major maintenance window is available, or recommendation itself requires modification 
which is governed by project requirements, or it is associated with long lead items, etc. In such 
cases, short-term and long-term recommendations shall be clearly highlighted. 

© All long-term recommendations shall be tracked clearly with definite timeline and taken forward 
to Risk register for follow-up. 

10. Compliance Assurance 

Holding Companies will conduct a compliance audit of this Guideline at approximately three-year 

intervals: these audits will be in addition to HSE internal audits. 

The main audit deliverable is a formal and structured report for the attention of the HSE Risk 

Management Steering Committee. 

11. Performance KPIs 

Generally, Key Performance Indicators (KPIs) for this Guideline will be considered in the Process 

Safety Key Performance Indicators (KPIs) Guideline EGPC-PSM-GL-025. 

Specifically, any QRA shall be conducted 100 % compliance as per requirements of this Guideline. 

12. Deviation 
No deviation is allowed from the requirements of this guideline. 
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14, List of Annexes 


¢ Annex A — Table Al gives an example and a sample for the Process Hazards, Events, Sequences, 
Incident Outcomes, and consequences. 

* Annex B — Gives details to determine and understand the different values of Vulnerability of 
Human for different Consequences/Impacts of Major Hazard Events. 

e Annex C- Figures C1-C5 provide examples for Event Tree for a range of different releases. 

*« Annex D—Tables D1 & D2 give a full list of the QRA study deliverables. 

e Annex E — The QRA Tolerance Criteria- as per mentioned in the Risk Management Standard 
EGPC-PSM-ST-001. 
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Annex B - Gives details to determine and understand the different values of Vulnerability of 
Human for different Consequences/Impacts of Major Hazard Events 
B- The Vulnerability of Human 
In order to understand the vulnerability different values, the following terminologies shall be 
identified: 
The Vulnerability is the probability that an individual is fatally injured from being exposed to a 


given consequence effect or threshold.” And sometimes referred to as: lethality /fatality rate 
/fatality probability. 


Fatality is used to refer to qualitative effect 
Lethality refers to the quantitative effect, namely the fraction/percentage of the exposed 
population who would suffer fatality on exposure to a given consequence level. 
Radiation is here always used to refer to thermal radiation. 
Probit: a function that relates lethality to the intensity or concentration of a hazardous effect and 
the duration of exposure. It typically takes the form: 
Pr=at+b @nv 
Where Pr = probit a, b are constants V = “dose”, typically: 
For toxic materials: 
V=(c"t) 
Where c = concentration n=constant t= exposure duration 
For thermal radiation: 
V= (I*t) 
Where | = thermal radiation t= exposure duration 
The Vulnerability data and Criteria are driven from the international data directory and the reliable 
relevant references, e.g. the International Oil and Gas Producers association (IOGP) report no. 434 
(14) - March 2010 (vulnerability of humans), report no. 434 (15) — 4 March 2010- (vulnerability of 
plant/structure), Guidelines for Quantitative Risk Assessment, ‘Purple Book’, Publication Series on 
Dangerous Substances, CPR 18E, Human Vulnerability to Thermal Radiation Offshore, Health and 
Safety Laboratory, HSL/2004/04, Chemical Industries Association (CIA) Guidance for the Location 
and Design of Occupied Buildings on Chemical Manufacturing Sites (3rd Edition), American 
Petroleum Institute API 521, API RP 752 & API RP 753 
From the previous references the following information concerning the vulnerability of humans to 
the consequences of major hazard events producing and/or processing hydrocarbon fluids, has 
been driven (Not, for further and more deep information the previous references, as well as other related 
references, could be visited). 
B-1 Fire (Thermal Radiation) 
B-1-1- Engulfment by fire: 
A person momentarily and only partially exposed directly to fire is most likely to suffer pain and 
non-fatal burns. 
A person fully or substantially engulfed by fire can be considered to suffer fatality. 
For the purposes of QRA, the following lethality levels are recommended: 
* 100% lethality for people outdoors engulfed by a jet fire, pool fire or fireball 
* 100% lethality for members of the public outdoors engulfed by a flash fire 
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* 50% to 100% lethality, depending on ease of escape, for workers wearing fire resistant clothing 
made from fabrics (meeting the requirements of NFPA 2112 [11] or equivalent .. reference |OGP- Report 
no. 434-14.). 
B-1-2- Thermal Radiation 
The effects of thermal radiation depend strongly on the thermal radiation flux, the duration of 
exposure, the type of clothing worn, the ease of sheltering, and the individual exposed. Hence, the 
information provided below provides guidance on the range of effects rather than exact 
relationships between thermal radiation and effects valid in all circumstances. 
Table (B1) summarizes thermal radiation exposure effects over a range of radiation fluxes. 
Table (B2) sets out Thermal Radiation Criteria applicable to longer fire durations, i.e. to jet fires and 
pool fires, for which the exposure duration is more dependent on the ability to escape than on the 
fire duration. 


(Note: ANSI/API Standard 521 sets out permissible design levels for thermal radiation exposure to flares. for 
which the exposure duration is more dependent on the ability to escape than on the fire duration). 


Thermal Radiation Effect 

(kw /m?) 

1.2 Received from the sun at noon in summer 

2 Minimum to cause pain after 1 minute 

less than 5 Will cause pain in 15 to 20 seconds and injury after 30 seconds’ 
exposure 

Greater than 6 Pain within approximately 10 seconds: rapid escape only is possible 

12.5 Significant chance of fatality for medium duration exposure. 

25 Likely fatality for extended exposure. 

35 Significant chance of fatality for people exposed instantaneously, 

Table B1: Thermal Radiation Exposure Effects (Ref. [2]) 

Thermal radiation Effect 

(kW /m2) 

35 Immediate fatality (100% lethality) 

20 leading to fatality unless rescue is effected quickly 

12.5 Extreme pain within 20 s: movement to shelter is instinctive: fatality 
if escape is not possible. 
Outdoors/offshore: 70% lethality 
Indoors onshore: 30% lethality* 

6 Impairment of escape routes 

4 Impairment of embarkation areas 

Note: People indoors are only vulnerable if they have line-of-sight exposure to thermal 

radiation, hence a lower lethality than for people outdoors. 


Table B2: Thermal Radiation Criteria (use for jet and pool fire) (Ref. [2]) 


For short exposures (up to a few tens of seconds, typical of fireballs), thermal radiation dose units 
(tdu) should be used: 


Dose (tdu) = (I*/)t 
Where | = incident thermal flux (kW/m2) t = duration of exposure (s) 
Thermal dose units thus have the units (kW/m2)*/s. 
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Table B3 sets out Thermal Dose Criteria, which should be used for fireballs. 


Thermal Dose Units Effect 

((kW/m2)4/3s) 

1000 1% lethality | 
1800 50% lethality, members of the public 

2000 50% lethality, offshore workers 

3200 100% lethality 


Table B3: Thermal Dose Fatality Criteria (use for fireballs) (Ref. [2]) 

B-1-3- Thermal Radiation for People Inside Buildings 
People inside buildings may be vulnerable to the building catching fire if combustible building 
material is exposed to the fire (either to a directly impinging fire or to radiation). 
Two types of ignition are recognized: 

© Piloted ignition, resulting from the flame impinging directly on a surface 

* Spontaneous ignition, resulting from exposure to thermal radiation from a fire. 
Personnel inside a building are vulnerable to the building catching fire if they cannot escape in 
sufficient time. This will depend on the time to ignition as compared to the time to alert the people 
inside to the source fire to evacuate. 
People inside a building are also vulnerable if escape routes are exposed to thermal radiation in this 
case the Criterion of 6 kW/m2 can be applied. 


B-2 Explosion (Blast Overpressure) 
B-2-1- For people Onshore, Outdoors and in the Open 
The following lethality levels are recommended: 
e 0,35 bar overpressure: 15% lethality for people outdoors, in the open, 
* 0.5 bar overpressure: 50% lethality for people outdoors, in the open, 
B-2-2- For people onshore, outdoors but adjacent to buildings or in unprotected 
structures (e.g. process units), 
The following lethality levels are recommended: 
© 0.35 bar overpressure: 30% lethality for people outdoors, 
© 0.5 bar overpressure: 100% lethality for people outdoors, 
B-2-3- For People Indoors 
The lethality level depends on the building type as well as the overpressure. Two frequently used 


sets of relationships between lethality level and overpressure are presented in API RP 752, and CIA 
Guidance. 


B-2-4- For Personnel Offshore in Modules Affected by an Explosion, 
The following approach is suggested: 


* 100% lethality for personnel in the module where the explosion occurs, if the explosion 
overpressure exceeds 0.2 to 0.3 barg 

* 100% lethality in adjacent modules if the intervening partition (wall or deck) is destroyed 
by the explosion. 
(Note: A more sophisticated approach could involve more detailed study of other explosion 
characteristics: overpressure phase duration and impulse. A probabilistic approach is 
recommended to estimate the likelihood of exceeding overpressures that could result in 
immediate fatality, escalation within the module, and escalation to adjacent areas). 
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B-3- Toxic Gases (Toxic Gas Exposure) 


The most likely toxic gas present in oil and gas production hydrocarbon fluids is Hydrogen Sulphide 
(H2S). The effects likely to be experienced by humans exposed to various concentrations of H2S are 
described in table B4 


H2S Concentration Effect 

20-30 ppm | Conjunctivitis 

50 ppm Objection to light after 4 hours exposure. Lacrimation 

150 - 200 ppm Objection to light, irritation of mucous membranes, headache 

200 - 400 ppm Slight symptoms of poisoning after several hours 

250 - 600 ppm Pulmonary edema and bronchial pneumonia after prolonged | 


exposure 


500 - 1000 ppm 


Painful eye irritation, vomiting. 


1000 ppm Immediate acute poisoning 
| 1000 - 2000 ppm Lethal after 30 to 60 minutes 
> 2000 ppm Rapidly lethal 


Table B4: Effects of Exposure to Hydrogen Sulphide (Ref. [2]) 

Table B5 gives the SLOT & SLOD DTL Values and Probit Constants (concentration in ppm, duration in 
minutes) for deferent toxic gases, 

Table B6 gives example concentrations (ppm) to give 1% and 50% Lethality for 10 minute and 30 
minute Exposures for deferent toxic gases. 


Material HSE SLOT & SLOD HSE Probit l TNO Probit 

stot | stop | “0 a b a a b a 
Ammonia 3.78» 108) 108" 2 4324 | 232 2 16.33 1 2 
Carbon Monoxide | 40125 | 57000 1 67.68 | 668 1 7.26 1 1 
Chlorine 1.08» 105] 40" 2 15.33 | 155 2 499 | 05 275 
Hydrogen Sulphide | 2» 10% ys 4 30.08 116 4 10.87 1 
Sulphur Dioxide ]4.66« 108) 740" 2 10.23 | oss 2 16.89 1 
Hydrogen Fluoride }| 12000 | 41000 1 36.44 | 4.16 1 6.70 1 
Nitrogen Dioxide SER: | eae 2 1161 | 124 2 16.26 1 


10° 


Table B5: The SLOT & SLOD DTL Values and Probit Constants (concentration in ppm, duration in minutes) 


for deferent toxic gases (Ref. [2]) 


10 minutes, 1% lethality | 30 minutes, 1% lethality 10 minutes, 50% lethality | 30 minutes, 50% lethality 


HSE SLOT | TNO Probit | HSE SLOD 
3550 2435 


1338 688 


60 71 


508 208 


304 840 


203 


Table B6: Examples for the concentrations (ppm) to give 1% and 50% Lethality for 10 minute and 30 minute 
Exposures for deferent toxic gases (Ref. [2]) 
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Annex C — Figures C1-C5 are examples for Event Tree for a range of different releases 


Jet Fire 
Horizontal 
No Effect 
Jet Fire 
a No Effect 
immediate 
en BLEVE 
Flash Fire 
Short Release Fractioh 
Explosion 
| No Effect 
Flash Fire 
Delayed Ignition | Explosion Pioatvesed 
No Immediate No Effect icuneronis 
ion time-steps 
No ignition 


Figure C1: Continuous release without rainout 
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Explosion Progressed 
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Figure C2: Continuous release with rainout 
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BLEVE + Pool Fire 
BLEVE alone 
Flash Fire + Pool fire 
sia Flash Fire alone 
Triton Explosion + Pool Hire 
Explosion alone 
Pool Fire alone 
No Etfect 
il Flash Fire + Pool Fird 
Delayed ignition _[ Explosion Progressed 
Dispersion’ No Effect 5 ee 
No ignition —— 
No immediate | AND 
— oases Residual Pool Fire 
No Ettect 


Figure C3; Instantaneous release with rainout, no vaporising pool left behind 


BLEVE + Pool Fira 
BLEVE alone 
Flash Fira + Poo Fhe 
immediate 
[Tontton 
Flash Fire + Pool Fro” 
Delayed igniton | Explosion Progrossed 
= P 2 ff through 
inital — Mette 
time-stops 
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instant nik ‘No lgnition 
asia Residual Pool Fire 
No Etfoct 
No Immediate 
Ignition a0 Flash Firo + Pool Fire ® 
Delayed ignition _[ Explosion Progrossod 
Continuous Dispersion? No fect ‘consequence 
‘Giouds trom, time stops 
Evaporation’ | an [2 tlion | 
4 Rasidual Pool Fire 
eae No Effect 


Figure C4: Instantaneous release with rainout, vaporising pool left behind 
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Flash Fi 
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Figure C5: Instantaneous release without rainout 
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Annex D — Tables D1 & D2 give a full list of the QRA study deliverables 


Table D1 gives the Consequence deliverables 


Consequence Consequence Measure 
Forms 
Jet Fire: Release rate, jet flame length, Surface Emissive Power (SEP), downwind distance to 


1.6kW/m2, 4.7kW/m2, 6.3kW/m2, 12.5kW/m2 and 37.5kW/m2. 


In addition, radiation levels at the various onsite and offsite considered 
populations (indoor and outdoor) shall be reported. 


Pool Fire/Sea Pool 
Fire: 


Release rate, pool diameter, SEP, downwind distance to 1.6kW/m2, 4.7kW/m2, 
6.3kW/m2, 12.5kW/m2 and 37.5kW/m2. 

In addition, radiation levels at the various onsite and offsite considered 
populations (indoor and outdoor) shall be reported. 


Fireball/BLEVE: 


Fireball radius, BLEVE radius, downwind distance to 1.6kW/m2, 4.7kW/m2, 
6.3kW/m2, 12.5kW/m2 and 37.5kW/m2. 

In addition, radiation levels at the various onsite and offsite considered 
populations (indoor and outdoor) shall be reported. 


Bund Fire/Rim Seal 
Fire/Full Surface 
Fire 


Diameter, SEP, downwind distance to 1.6kW/m2, 4.7kW/m2, 6.3kW/m2, 
12.S5kW/m2 and 37.5kW/m2. 
In addition, radiation levels at the various onsite and offsite considered 
populations (indoor and outdoor) shall be reported. 


Flammable Gas 
Dispersion Results 


Distance 0.5 LFL, LFL and UFL. At all points and heights of interest (e.g. HVAC inlet, 
sources of ignition, EER measures, etc.). 


Explosion Downwind distance to 30mbar, 70mbar, 100mbar, 200mbar, 300mbar and 

Overpressure 500mbar. 

Results In addition, explosion overpressure and impulse duration at the various onsite and 
offsite considered populations (indoor and outdoor) shall be reported. 

Toxic Gas Distance downwind represents specific adverse health effect, on various 


Dispersion Results 


considered populations onsite and offsite, from specific concentration of toxic 
material for various exposure times, 

Various approaches are used to determine the consequences of toxic gases and 
have various purpose: 


° IDLH 
. ERPG/AEGL 
. Probit 


° SLOT & SLOD DTLs 


For the Risk Calculation, Probit method is recommended to be used as it takes into 
account both concentration and duration of exposure. 


(More details are given in 8.4.2., 8.4.2.5., 8.4.4. & 8.4.4.3.). 


Smoke: 


CO, CO2 concentrations at, downwind distance to various effective concentrations 
(more details are given in |OGP-14). 
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results height of 
interest 


Consequence Consequence Measure 
Forms 
Consequence All consequences effects on people shall be calculated at 1 meter above ground 


level. 


For ingress into buildings, the concentration shall be monitored at air intake 
height, where such information is not available, 3m height to be considered. 


For multi-story units, heights shall be based on where major equipment is located. 
All other equipment can be considered at ground level. 


Notes 


(1) Justification for the selected SEP shall be furnished/ provided for the pool fire (land/sea) 
scenarios. 

(2) Bund fire and full surface fire scenarios considering credit for the smoke. 

(3) Radiation levels, flammable concentration and toxic concentration (H2S and SO2) shall 
be reported at various populations identified for the new facilities and existing facilities (if 
any). 

(4) Explosion overpressure results along with associated impulse duration shall be reported 
for the critical buildings, non-critical buildings, and manned/unmanned buildings. 


Table D2 gives the Risk deliverables (Risk Various Indicators) 


Process F-N Curve 
IRPA F-N Curve (Workers) (Public) 


- LSIR Contour for Gathering places 


each unit/segment | foreach | Foreach 
Onshore | /isolatable section worker worker 
- Cumulative LSIR group group 


(accommodations / 
administrative buildings / | For nearby public 

mess / canteen /rest places population 
/ entertainment 


contour places...etc.) 


Offshore 


LSIR value for each 


Gathering places 

For each For each (accommodations / mess / 
worker worker canteen /rest places / 
group group entertainment 

places...etc.) 


deck 


1 


Results illustrated in form of: 
- Contours on geographical maps or plot plan, graphs, curves, and 


- Tables shall be provided to show the Risk values for both indoor and outdoor vulnerabilities (for 
both onsite and offsite populations). 
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Annex E — Shows the QRA Tolerance Criteria- as per mentioned in the Risk Management 
Standard EGPC-PSM-ST-001 

E- Quantitative Risk Assessment Tolerance Criteria 
Quantitative Risk Criteria are standards used to translate numerical Risk estimates, as produced by a 
Quantitative Risk Assessment (QRA), into value judgements such as ‘negligible Risk’ (e.g. the Risk 
value is lower than 10-6 which means lower than 1 fatality every 1 million years), that can then be 
set against other value judgements such as ‘high economic benefit’ in the decision-making process. 
To define the three bands of Risk (acceptable, Tolerable if ALARP, and unacceptable), two levels of 
Risk Criteria are required: 

e Amaximum tolerable Criterion above which the Risk is intolerable, 

« A broadly acceptable Criterion below which the Risk is insignificant, and 

« Between these two Criteria, the ALARP region is laid 


Risks to people may be expressed in two main forms: 


© Individual Risk — the Risk experienced by a person. 

* Societal (or Group) Risk — the Risk experienced by the whole group of people exposed to the 
hazard. Where the people exposed are members of the public, the term Societal Risk is often 
used. Where workers are isolated and members of the public are unlikely to be affected, the 
term Group Risk is often used. In this document, the term Societal Risk is used to encompass 
both Public and Worker Risk. 


E-1- Individual Risk Criteria (IRPA) 


Individual Risk Criteria are intended to show the frequency at which an individual (worker or public) 
may be expected to sustain a given level of harm from the realization of specified hazards. It is 
usually taken to be the Risk of death and usually expressed as a Risk per year. 


Individual Risk is calculated by identifying all sources of fatality Risk to a given individual, deriving 
the contribution from each source and then summing these to give the overall Risk. For typical oil, 
gas and petrochemical workers the primary sources of Risk as a minimum: 


* Transport, e.g., road traffic accidents, air/sea transport accidents. 

e Hydrocarbon related, e.g., loss of containment leading to toxic releases, fires or explosions. 

(Note: Companies have the choice to consider the Occupational Safety Risks in their Quantitative Risk 
Assessment, e.g., slips, trips and falls, drowning, dropped objects, lifting, working at heights, etc. within the 
overall Risk Calculations (which might increase the overall Risk value)). 
Individual Risk Criteria are most expressed in the form of Individual Risk Per Annum (IRPA). The IRPA 
is a representative worker of a given worker groups considering expected occupancy at all the 
locations he is expected to be present within the hazardous location throughout the year. This 
includes plants, accommodations, recreational activities, etc. The calculation excludes the duration 
for which personnel is not present at the site due to reasons such as annual leave, personnel is 
considered not exposed to facility operations or occupational Risk during this duration. This 
Criterion is applicable for all COMPANIES belonging to ENTITIES. It is mandatory to demonstrate 
that Risk levels are within the Criteria given in Figure & Table E1 
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ON ACC ERTABLE 10°per year (worker) 


10“per year (public) 


Increasing Risk 


~------ “YE -------------- 10°°per year (both) 


Figure E1; ALARP Demonstration (Ref. UK-HSE - onshore process Individual Risk criteria) 


Workers Member of public 


Maximum Tolerable Criterion 10* per year 10" per year 


Broadly Acceptable Criterion 10° per year 
Table E1; Tolerability Criteria 


Note (1): Individual Risk Criteria are intended to demonstrate that individual people are not exposed to 
excessive Risk, assuming all individuals are equally exposed and protected. 

Note (2): Individual Risk to workers means Individual Risk to onsite personnel and outside nearby same 
business’ industrial facilities only (i.e. petrochemical, ail and gas facilities), and Individual Risk to public means 
Individual Risk to offsite personnel. 


At the top of the triangle is the unacceptable level, on or above which the Risk is so great or the 
outcome so unacceptable that it must be reduced immediately. 


At the other extreme is the broadly acceptable region, where the Risk is so low that there is no 
further requirement to undertake additional Risk reduction measures, i.e., the Risk is, or has been 
made, so small that no further precaution is warranted. 


In between these two extremes, lies a wide range of tolerable Risk levels to which the ALARP 
principle applies, i.e., the Risk must be reduced to the lowest level practicable, bearing in mind the 
benefits flowing from its acceptance and taking account of the costs of any further reduction. Thus, 
for the Risks, which fall within the Tolerable region, some weighing of costs and benefits i.e., Cost- 
Benefit Analysis is necessary to determine compliance with the ALARP principle. 


E-2- Societal (Group) Risk Criteria: 


Societal Risk evaluation is concerned with the estimation of the chances of more than one individual 
being harmed simultaneously by an incident. The likelihood of the primary event (an accident at a 
major hazard plant) is still a factor, but the consequences are assessed in terms of the level of harm 
and the numbers affected (severity), to provide an idea of the scale of an accident in terms of 
numbers killed or harmed. 


Societal Risk is dependent on the Risks from the substances and processes located on a major 
hazard installation. A key factor in estimating Societal Risk is the population inside and around the 
site: in particular, its location and density. 
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The Criteria may be defined to limit the Risk of major accidents and help target Societal Risk 
reduction measures (such as restrictions on concurrent activities or land use, enhanced engineered 
safeguards, and improved building siting or protection). 

The concept of the Societal Risk against the Individual Risk is illustrated in the following 
Figure E2. Where situations / and // have equal Individual Risk levels, while situation // has a larger 
Societal Risk (SR) because in situation // more people are exposed than in situation /. Therefore, if 
the Individual Risk levels are acceptable in both situations, the Societal Risk may not be acceptable 
for situation //. 


Figure E2: The concept of Societal Risk (Ref. [12]). 


E-2-1- FN-diagram 

The FN curve is the curve of cumulative frequency versus numbers of fatalities on a logarithmic 
scale. FN curves are frequency-fatality plots, showing the cumulative frequencies (F) of events 
involving N or more fatalities. They are derived by sorting the frequency-fatality (FN) pairs from 
each outcome of each accidental event and summing them to form cumulative frequency-fatality 
(FN) coordinates for the plot. 

A common form of presenting Risk Tolerability Criteria for Societal Risk on an FN diagram is to have 
two Criteria lines to distinguish three regions: an area where Risk is intolerable, an area where it is 
broadly acceptable and a region where it requires further assessment and Risk reduction as far as is 
reasonably practicable. ENTITIES’ Criteria for Societal Risk is shown in Figure E3 
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Figure E3: Criteria for Societal Risk (Ref. [2]). 
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At the top of the curve is the unacceptable level (F = 2.0E-04, for N = 50, and the Slope = -1), on or 
above which the Risk is so great or the outcome so unacceptable that it must be reduced 
immediately. 


At the other extreme is the broadly acceptable level (F = 2.0E-06, for N = 50, and the Slope = -1), 
where the Risk is so low that there is no further requirement to undertake additional Risk reduction 
measures, i.e., the Risk is, or has been made, so small that no further precaution is warranted. 


In between these two extremes, lies a wide range of tolerable Risk levels to which the ALARP 
principle applies, i.e., the Risk must be reduced to the lowest level practicable, bearing in mind the 
benefits flowing from its acceptance and taking account of the costs of any further reduction. 


£-2-2- Potential Loss of Life (PLL) 
The other main measure for Societal Risk is the annual fatality rate, where the frequency and 


number of fatalities are combined into a Potential Loss of Life (PLL), which is a convenient one- 
dimensional measure of the total number of expected fatalities. 


Potential Loss of Life (PLL) is simply the sum of the products of all f-N pairs, (i.e., Potential Loss of 
Life = ZFN [people/year]) 

PLL is well suited for comparing alternative solutions for the same facility is relatively easy to 
understand for non-Risk specialists and must be calculated to be able to derive the cost- 
effectiveness of Risk reduction options (Multiplying the annual PLL by the expected lifetime of a 
facility gives a Lifetime PLL by which the overall number of fatalities incurred by the facility, over its 
entire operational period, can be estimated), lifetime PLL is how Risk reduction measures should be 
assessed by using Cost-Benefit Analysis. PLL should be presented as a measure to compare the 
relative degree of “safety”, expressed as potential loss of life for different options or developments. 
This should be used in conjunction with IRPA levels. 


E-3- Risk Contours (LSIR) Criteria for Land Use Planning (LUP) 


Risk contours are Iso-Risk contours plot represent the geographical variation of the Risk for a 
hypothetical individual who is positioned at a particular location for 24 hours per day, 365 days per 
year. This is also known as Location-Specific Individual Risk (LSIR). 


Land Use Planning (LUP) Criteria is a planning tool to advice on new developments, 
accommodations that are constructed near the existing facility boundary or for siting the facility in 
the vicinity of the existing occupied building area or master plan updates for existing assets. The 
purpose of defining LUP zones is to minimize Risk to people around the hazardous facility by 
specifying how close certain types of facilities can be developed. For example, relatively low 
occupancy nonindustrial development such as warehouse can be allowed to be relatively close to 
the facility boundary whereas vulnerable populations, such as schools and hospitals need to be 
further away from the facility. 

The recommended Individual Risk levels to be used, in respect to hazardous substances/sites, are 
including the Risk contributions from all sources with the inner zone Criteria of LSIR from 10% to 10° 
5: middle zone 10° to 10° and outer zone beyond 10° per year. Restrictions are placed on activities 
or structures within the various zones, as shown in the following Figure and table E3. 
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Annual Individual Risk 


100 in a million 10inamillion 1 inamillion 
(104 ) (10° ) (10° ) 


Hauora 5: 


Risk |No other] Manufacturing, Commercial, All other uses 

source |land use| warehouses, open offices, low-density! including institutions, 
space (parkland, golf |residential high-density 
courses, etc.) residential, etc. 


Figure £3: Allowable Land Uses (Ref. [9]) 


Location Specific 


Zones Examples for types of Allowable Land Uses Individual Risk (LSIR) 


Table E3: Definition of Zones for Land Use Planning (LUP) 


Note 1: The LUP above Criteria shall be used in conjunction with the F-N curve, H2S zones and consequence- 
based approach for toxic hazards as applicable. 

Note 2: The LUP Criteria shall be applied for new oil and gas facilities to be selected at safe distances as much 
as possible from areas with a different designation, whereas operating facilities and old facilities may be 
subjected to encroachments and outside activities, unfortunately, the responsible law for preventing such 
encroachments does not support the LUP Criteria. 
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